Common UNIX Printing System IPP Tags Memory Corruption Vulnerability
Cisco-SA-20071031-CVE-2007-4351 · Medium · Published · Updated
The Common UNIX Printing System (CUPS) versions 1.3.3 and prior contain a vulnerability that can allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or execute arbitrary code with the privileges of the user. The vulnerability exists in the ippReadIO() function when processing Internet Printing Protocol (IPP) tags. The function causes an off-by-one error when allocating space. An unauthenticated, remote attacker could send a request with crafted tags to overwrite one byte on the stack with a zero. The attacker could crash the daemon or possibly execute arbitrary code. The vendor has confirmed this vulnerability in release notes and released an updated version. The vulnerability requires the attacker to connect to the IPP TCP port to perform an attack. However, the default configuration of CUPS does not allow remote hosts to connect to this port. This configuration should mitigate the potential for this attack. IT departments that deploy and use CUPS without changing the default configuration may not be at risk. The severity of the impact will vary depending on the system on which CUPS is deployed. If this system is used for multiple services, a DoS condition could cause other services besides the CUPS service to crash, which may affect other users and departments. If code execution is accomplished, it will most likely be in the context of the CUPS user. This user probably has limited privileges.
Workarounds
Administrators are advised to apply the appropriate update.
Administrators are advised to restrict access to trusted users.
The Cisco Applied Intelligence team has created the following companion document to guide administrators in identifying and mitigating attempts to exploit this vulnerability prior to applying updated software: Identifying and Mitigating Exploitation of the Wide Area Application Services Common UNIX Printing System Vulnerabilityhttp://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a00809a1f19.html
| CVEs | CVE-2007-4351 |
|---|---|
| Cisco Bug IDs | NA |
| CVSS Score | Base 6.4 Base 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:C/CDP:N/TD:N/CR:ND/IR:ND/AR:ND |
| Product Names From Source | Cisco Wide Area Application Services (WAAS) |
Related Products
| Product | CVE | Evidence |
|---|